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AMENDMENTS TO THE CLAIMS: 

Please amend claims 1, 4, 17, 20, 33, 49, 65, 67, 68, 81 and 84 as follows. 
This listing of claims will replace all prior versions, and listings, of claims in the 
application: 

1. (currently amended) A computer program product comprising a computer program 
operable to control a computer to detect a known computer program within a packed computer 
file, said packed computer file being unpacked upon execution, said computer program 
comprising: 

resource data reading logic operable to read for reading resource data within said packed 
computer file, said resource data specifying program resource items used by said known 
computer program and bemg-readable by a computer operating system without dependence upon 
which unpacking algorithm is used by said packed computer file; and 

resource data comparing logic operable to compare for generating characteristics of said 
resource data and for comparing said characteristics of said resource data with characteristics of 
resource data of said known computer program to detect and for detecting a match with said 
known computer program indicative of said packed computer file containing said known 
computer program. 

2. (original) A computer program product as claimed in claim 1, wherein said known 
computer program is one of: 

a Trojan computer program; and 
a worm computer program. 
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3. (original) A computer program product as claimed in claim 1, wherein said resource 
data comparing logic is operable to compare said resource data with characteristics of a plurality 
of known computer programs to detect if said packed computer program contains one of said 
plurality of known computer programs. 

4. (currently amended) A computer program product as claimed in claim 1, wherein said 
resource data comparing logic is operable to processes said resource data of said packed 
computer file to generate fingerprint data and to compare said fingerprint data with fingerprint 
data of said known computer program. 

5. (original) A computer program product as claimed in claim 1, wherein said program 
resource items used by said known computer program include one or more of: 

icon data; 
string data; 
dialog data; 
bitmap data; 
menu data; and 
language data. 

6. (original) A computer program product as claimed in claim 1, wherein said resource 
data specifies for each resource item a storage location of said resource item. 



-3- 



937612 



COWIE et al. 

Appl. No. 09/912,389 

March 22, 2005 

7. (original) A computer program product as claimed in claim 6, wherein said storage 
location of said resource item is specified as an relative offset value. 

8. (original) A computer program product as claimed in claim 1, wherein said resource 
data specifies for each resource item a size of said resource item. 

9. (original) A computer program product as claimed in claim 4, wherein said fingerprint 
data includes a checksum value calculated in dependence upon one or more of: 

a number of program resource items specified beneath each node within hierarchically 
arranged resource data; 

string names associated with program resource items within said resource data; and 
sizes of program resource items within said resource data. 

10. (original) A computer program product as claimed in claim 4, wherein said 
fingerprint data includes a number of program resource items specified within said resource data. 

11. (original) A computer program product as claimed in claim 4, wherein said 
fingerprint data includes a location within said resource data of an entry specifying a program 
resource item having a largest size. 

12. (original) A computer program product as claimed in claim 4, wherein said 
fingerprint data includes timestamp data indicative of a time of compilation of said known 
computer program. 
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13. (original) A computer program product as claimed in claim 4, wherein said 
fingerprint data includes a flag indicating which data is included within said fingerprint data. 

14. (original) A computer program product as claimed in claim 9, wherein said checksum 
value is rotated between each item being added into said checksum. 

15. (original) A computer program product as claimed in claim 1, wherein said packed 
computer file includes an unpacking computer program which upon execution decompresses said 
known computer program. 

16. (original) A computer program product as claimed in claim 1, wherein said packed 
computer file is a Win32 PE file. 

17. (currently amended) A computer program product comprising a computer program 
operable to control a computer to generate data for detecting a known computer program within 
a packed computer file, said packed computer file being unpacked upon execution, said 
computer program comprising: 

resource data reading logic operable to read for reading resource data within said packed 
computer file, said resource data specifying program resource items used by said known 
computer program and bemg-readable by a computer operating system without dependence upon 
which unpacking algorithm is used by said packed computer file; and 
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characteristic data generating logic operable to generate for generating characteristic data 
associated with said resource data for comparison with characteristics characteristic data of 
resource data of said known computer program to detect a match with said known computer 
program indicative of said packed computer file containing said known computer program. 

18. (original) A computer program product as claimed in claim 17, wherein said known 
computer program is one of: 

a Trojan computer program; and 
a worm computer program. 

19. (original) A computer program product as claimed in claim 17, wherein said 
characteristic data generating logic is operable to generate characteristic data from a plurality of 
known computer programs to enable detection of any of said plurality of known computer 
programs within said packed computer program.. 

20. (currently amended) A computer program product as claimed in claim 17, wherein 
said characteristic data generating logic is operable to processes said resource data of said packed 
computer file to generate fingerprint data for comparison with fingerprint data generated from 
packed computer files. 

21. (original) A computer program product as claimed in claim 17, wherein said program 
resource items used by said known computer program include one or more of: 

icon data; 
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string data; 
dialog data; 
bitmap data; 
menu data; and 
language data. 

22. (original) A computer program product as claimed in claim 17, wherein said resource 
data specifies for each resource item a storage location of said resource item. 

23. (original) A computer program product as claimed in claim 22, wherein said storage 
location of said resource item is specified as an relative offset value. 

24. (original) A computer program product as claimed in claim 17, wherein said resource 
data specifies for each resource item a size of said resource item. 

25. (original) A computer program product as claimed in claim 20, wherein said 
fingerprint data includes a checksum value calculated in dependence upon one or more of: 

a number of program resource items specified beneath each node within hierarchically 
arranged resource data; 

string names associated with program resource items within said resource data; and 
sizes of program resource items within said resource data. 
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26. (original) A computer program product as claimed in claim 20, wherein said 
fingerprint data includes a number of program resource items specified within said resource data. 

27. (original) A computer program product as claimed in claim 20, wherein said 
fingerprint data includes a location within said resource data of an entry specifying a program 
resource item having a largest size. 

28. (original) A computer program product as claimed in claim 20, wherein said 
fingerprint data includes timestamp data indicative of a time of compilation of said known 
computer program. 

29. (original) A computer program product as claimed in claim 20, wherein said 
fingerprint data includes a flag indicating which data is included within said fingerprint data. 

30. (original) A computer program product as claimed in claim 25, wherein said 
checksum value is rotated between each item being added into said checksum. 

31. (original) A computer program product as claimed in claim 17, wherein said packed 
computer file includes an unpacking computer program which upon execution decompresses said 
known computer program. 

32. (original) A computer program product as claimed in claim 17, wherein said packed 
computer file is a Win32 PE file. 
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33. (currently amended) A method of controlling a computer to detect a known computer 
program within a packed computer file, said packed computer file being unpacked upon 
execution, said method comprising the steps of: 

reading resource data within said packed computer file, said resource data specifying 
program resource items used by said known computer program and bemg-readable by a 
computer operating system without dependence upon which unpacking algorithm is used by said 
packed computer file; and 

generating characteristics of said resource data and comparing said characteristics of said 
resource data with characteristics of resource data of said known computer program to detect and 
detecting a match with characteristics of said known computer program indicative of said packed 
computer file containing said known computer program. 

34. (original) A method as claimed in claim 33, wherein said known computer program is 

one of: 

a Trojan computer program; and 
a worm computer program. 

35. (original) A method as claimed in claim 33, wherein said step of comparing compares 
said resource data with characteristics of a plurality of known computer programs to detect if 
said packed computer program contains one of said plurality of known computer programs. 
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36. (original) A method as claimed in claim 33, comprising processing said resource data 
of said packed computer file to generate fingerprint data and comparing said fingerprint data 
with fingerprint data of said known computer program. 

37. (original) A method as claimed in claim 33, wherein said program resource items 
used by said known computer program include one or more of: 

icon data; 
string data; 
dialog data; 
bitmap data; 
menu data; and 
language data. 

38. (original) A method as claimed in claim 33, wherein said resource data specifies for 
each resource item a storage location of said resource item. 

39. (original) A method as claimed in claim 38, wherein said storage location of said 
resource item is specified as an relative offset value. 

40. (original) A method as claimed in claim 33, wherein said resource data specifies for 
each resource item a size of said resource item. 
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41. (original) A method as claimed in claim 36, wherein said fingerprint data includes a 
checksum value calculated in dependence upon one or more of: 

a number of program resource items specified beneath each node within hierarchically 
arranged resource data; 

string names associated with program resource items within said resource data; and 
sizes of program resource items within said resource data. 

42. (original) A method as claimed in claim 36, wherein said fingerprint data includes a 
number of program resource items specified within said resource data. 

43. (original) A method as claimed in claim 36, wherein said fingerprint data includes a 
location within said resource data of an entry specifying a program resource item having a 
largest size. 

44. (original) A method as claimed in claim 36, wherein said fingerprint data includes 
timestamp data indicative of a time of compilation of said known computer program. 

45. (original) A method as claimed in claim 36, wherein said fingerprint data includes a 
flag indicating which data is included within said fingerprint data. 

46. (original) A method as claimed in claim 41, wherein said checksum value is rotated 
between each item being added into said checksum. 
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47. (original) A method as claimed in claim 33, wherein said packed computer file 
includes an unpacking computer program which upon execution decompresses said known 
computer program. 

48. (original) A method as claimed in claim 33, wherein said packed computer file is a 
Win32 PE file. 

49. (currently amended) A method of controlling a computer to generate data for 
detecting a known computer program within a packed computer file, said packed computer file 
being unpacked upon execution, said method comprising the steps of: 

reading resource data within said packed computer file, said resource data specifying 
program resource items used by said known computer program and bemg-readable by a 
computer operating system without dependence upon which unpacking algorithm is used by said 
packed computer file; and 

generating characteristic data associated with said resource data for comparison with 
characteristicG characteristic data of resource data of said known computer program to detect and 
detecting a match with said known computer program indicative of said packed computer file 
containing said known computer program. 

50. (original) A method as claimed in claim 49, wherein said known computer program is 

one of: 

a Trojan computer program; and 
a worm computer program. 
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51. (original) A method as claimed in claim 49, wherein said step of generating generates 
characteristic data from a plurality of known computer programs to enable detection of any of 
said plurality of known computer programs within said packed computer program.. 

52. (original) A method as claimed in claim 49, comprising processing said resource data 
of said packed computer file to generate fingerprint data for comparison with fingerprint data 
generated from packed computer files. 

53. (original) A method as claimed in claim 49, wherein said program resource items 
used by said known computer program include one or more of: 

icon data; 
string data; 
dialog data; 
bitmap data; 
menu data; and 
language data. 

54. (original) A method as claimed in claim 49, wherein said resource data specifies for 
each resource item a storage location of said resource item. 

55. (original) A method as claimed in claim 54, wherein said storage location of said 
resource item is specified as an relative offset value. 
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56. (original) A method as claimed in claim 49, wherein said resource data specifies for 
each resource item a size of said resource item. 

57. (original) A method as claimed in claim 52, wherein said fingerprint data includes a 
checksum value calculated in dependence upon one or more of: 

a number of program resource items specified beneath each node within hierarchically 
arranged resource data; 

string names associated with program resource items within said resource data; and 
sizes of program resource items within said resource data. 

58. (original) A method as claimed in claim 52, wherein said fingerprint data includes a 
number of program resource items specified within said resource data. 

59. (original) A method as claimed in claim 52, wherein said fingerprint data includes a 
location within said resource data of an entry specifying a program resource item having a 
largest size. 

60. (original) A method as claimed in claim 52, wherein said fingerprint data includes 
timestamp data indicative of a time of compilation of said known computer program. 

61. (original) A method as claimed in claim 52, wherein said fingerprint data includes a 
flag indicating which data is included within said fingerprint data. 
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62. (original) A method as claimed in claim 57, wherein said checksum value is rotated 
between each item being added into said checksum. 

63. (original) A method as claimed in claim 49, wherein said packed computer file 
includes an unpacking computer program which upon execution decompresses said known 
computer program. 

64. (original) A method as claimed in claim 49, wherein said packed computer file is a 
Win32 PE file. 

65. (currently amended) Apparatus for detecting a known computer program within a 
packed computer file, said packed computer file being unpacked upon execution, said apparatus 
comprising: 

a resource data reader operable to read for reading resource data within said packed 
computer file, said resource data specifying program resource items used by said known 
computer program and be+ftg-readable by a computer operating system without dependence upon 
which unpacking algorithm is used by said packed computer file; and 

a resource data comparito r comparator operable to compare for generating characteristics 
of said resource data and for comparing said characteristics of said resource data with 
characteristics of resource data of said known computer program to detect for detecting a match 
with said known computer program indicative of said packed computer file containing said 
known computer program. 
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66. (original) Apparatus as claimed in claim 65, wherein said known computer program 
is one of: 

a Trojan computer program; and 
a worm computer program. 

67. (currently amended) Apparatus as claimed in claim 65, wherein said resource data 
comparator is operable to compare said resource data with characteristics of a plurality of 
known computer programs to detect if said packed computer program contains one of said 
plurality of known computer programs. 

68. (currently amended) Apparatus as claimed in claim 65, wherein said resource data 
comparator is operable to processes said resource data of said packed computer file to generate 
fingerprint data and to compare said fingerprint data with fingerprint data of said known 
computer program. 

69. (original) Apparatus as claimed in claim 65, wherein said program resource items 
used by said known computer program include one or more of: 

icon data; 
string data; 
dialog data; 
bitmap data; 
menu data; and 
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language data. 

70. (original) Apparatus as claimed in claim 65, wherein said resource data specifies for 
each resource item a storage location of said resource item. 

71. (original) Apparatus as claimed in claim 70, wherein said storage location of said 
resource item is specified as an relative offset value. 

72. (original) Apparatus as claimed in claim 65, wherein said resource data specifies for 
each resource item a size of said resource item. 

73. (original) Apparatus as claimed in claim 68, wherein said fingerprint data includes a 
checksum value calculated in dependence upon one or more of: 

a number of program resource items specified beneath each node within hierarchically 
arranged resource data; 

string names associated with program resource items within said resource data; and 
sizes of program resource items within said resource data. 

74. (original) Apparatus as claimed in claim 68, wherein said fingerprint data includes a 
number of program resource items specified within said resource data. 
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75. (original) Apparatus as claimed in claim 68, wherein said fingerprint data includes a 
location within said resource data of an entry specifying a program resource item having a 
largest size. 

76. (original) Apparatus as claimed in claim 68, wherein said fingerprint data includes 
timestamp data indicative of a time of compilation of said known computer program. 

77. (original) Apparatus as claimed in claim 68, wherein said fingerprint data includes a 
flag indicating which data is included within said fingerprint data. 

78. (original) Apparatus as claimed in claim 73, wherein said checksum value is rotated 
between each item being added into said checksum. 

79. (original) Apparatus as claimed in claim 65, wherein said packed computer file 
includes an unpacking computer program which upon execution decompresses said known 
computer program. 

80. (original) Apparatus as claimed in claim 65, wherein said packed computer file is a 
Win32 PE file. 

81. (currently amended) Apparatus for generating data for detecting a known computer 
program within a packed computer file, said packed computer file being unpacked upon 
execution, said apparatus comprising: 
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a resource data reader operable to read for reading resource data within said packed 
computer file, said resource data specifying program resource items used by said known 
computer program and bemg-readable by a computer operating system without dependence upon 
which unpacking algorithm is used by said packed computer file; and 

a characteristic data generator operable to generat e for generating characteristic data 
associated with said resource data for comparison with c h arac teri sti c s c h arac teri s t i c data of 
resource data of said known computer program to detect and for detecting a match with said 
known computer program indicative of said packed computer file containing said known 
computer program. 

82. (original) Apparatus as claimed in claim 81, wherein said known computer program 
is one of: 

a Trojan computer program; and 
a worm computer program. 

83. (original) Apparatus as claimed in claim 81, wherein said characteristic data generator 
is operable to generate characteristic data from a plurality of known computer programs to 
enable detection of any of said plurality of known computer programs within said packed 
computer program.. 

84. (currently amended) Apparatus as claimed in claim 81, wherein said characteristic 
data generator is operable to processes said resource data of said packed computer file to 
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generate fingerprint data for comparison with fingerprint data generated from packed computer 
files. 

85. (original) Apparatus as claimed in claim 81, wherein said program resource items 
used by said known computer program include one or more of: 

icon data; 
string data; 
dialog data; 
bitmap data; 
menu data; and 
language data. 

86. (original) Apparatus as claimed in claim 81, wherein said resource data specifies for 
each resource item a storage location of said resource item. 

87. (original) Apparatus as claimed in claim 86, wherein said storage location of said 
resource item is specified as an relative offset value. 

88. (original) Apparatus as claimed in claim 81, wherein said resource data specifies for 
each resource item a size of said resource item. 

89. (original) Apparatus as claimed in claim 84, wherein said fingerprint data includes a 
checksum value calculated in dependence upon one or more of: 
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a number of program resource items specified beneath each node within hierarchically 
arranged resource data; 

string names associated with program resource items within said resource data; and 
sizes of program resource items within said resource data. 

90. (original) Apparatus as claimed in claim 84, wherein said fingerprint data includes a 
number of program resource items specified within said resource data. 

91. (original) Apparatus as claimed in claim 84, wherein said fingerprint data includes a 
location within said resource data of an entry specifying a program resource item having a 
largest size. 

92. (original) Apparatus as claimed in claim 84, wherein said fingerprint data includes 
timestamp data indicative of a time of compilation of said known computer program. 

93. (original) Apparatus as claimed in claim 84, wherein said fingerprint data includes a 
flag indicating which data is included within said fingerprint data. 

94. (original) Apparatus as claimed in claim 89, wherein said checksum value is rotated 
between each item being added into said checksum. 
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95. (original) Apparatus as claimed in claim 81, wherein said packed computer file 
includes an unpacking computer program which upon execution decompresses said known 
computer program. 

96. (original) Apparatus as claimed in claim 81, wherein said packed computer file is a 
Win32 PE file. 
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